EUVD-2026-34947
GHSA-4jj4-xwhh-x5m2
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The LearnPress - Backup & Migration Tool plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.4 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
AnalysisAI
PHP Object Injection in the LearnPress - Backup & Migration Tool WordPress plugin (versions ≤ 4.1.4, by ThimPress) allows authenticated administrators to supply maliciously crafted serialized data through the plugin's import functionality, triggering unsafe PHP deserialization. The vulnerability itself carries no direct impact in isolation - exploitation is contingent on a separate plugin or theme installing a usable POP (Property-Oriented Programming) chain on the same site, at which point an attacker can escalate to arbitrary file deletion, sensitive data retrieval, or remote code execution. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the CVSS score of 6.6 (High complexity, High privileges required) reflects the constrained real-world conditions.
Technical ContextAI
CWE-502 (Deserialization of Untrusted Data) describes the root cause: PHP's unserialize() function reconstructs arbitrary object graphs from attacker-controlled input without type validation, enabling property injection into any class visible to the PHP process. The Wordfence intelligence report pinpoints two specific source files as the deserialization sinks: inc/admin/providers/learnpress/class-lp-import-learnpress.php (line 581) and inc/parsers.php (line 871), both reachable via the plugin's import workflow. The affected product is identified by CPE cpe:2.3:a:thimpress:learnpress_-_backup_&_migration_tool:*:*:*:*:*:*:*:*, a WordPress plugin developed by ThimPress for importing and exporting LearnPress LMS course data. PHP Object Injection becomes weaponizable only when a POP chain - a sequence of magic method calls (__wakeup, __destruct, __toString, etc.) that can be chained across loaded classes to produce a harmful side effect - is present in any co-installed code, making the overall attack surface a function of the combined plugin/theme ecosystem on the target WordPress site.
RemediationAI
Update the LearnPress - Backup & Migration Tool plugin to version 4.1.5 or later; this version is referenced in the WordPress plugin repository (https://plugins.trac.wordpress.org/browser/learnpress-import-export/tags/4.1.5/inc/functions.php#L384) and is the earliest tag post-4.1.4, suggesting it contains the fix, though the patched version has not been independently confirmed via a formal vendor changelog. Site operators should apply the update via the WordPress plugin dashboard and verify the installed version. As a compensating control prior to patching, administrators can deactivate the LearnPress - Backup & Migration Tool plugin entirely, which removes the vulnerable import endpoint from the attack surface with no impact on core LearnPress LMS functionality. Administrators should also audit co-installed plugins and themes for known POP chain exposure using tools such as PHPGGC (PHP Generic Gadget Chains) to understand whether a chained attack is currently feasible on their specific installation. Restricting WordPress admin access to trusted IP ranges via server-level controls or a WAF rule further reduces the already-high privilege barrier to exploitation.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today